In June 2017, the NotPetya virus crippled many large companies including Merck and Mondelez (the manufacturer of Nabisco, Cadbury, and Toblerone). The aggregated losses, including property damage, operational disruptions, and supply chain disruptions, added up to hundreds of millions of dollars per large corporation. The billion dollar question: who would bear this loss? A case in Cook County, Illinois, will provide at least a partial answer.
By way of background, companies mitigate the risk of losses through their Commercial General Liability (CGL) policy. The policy protects the company from extraordinary events. CGL policies generally offer coverage for bodily injury and property damage claims, but CGL policies did not protect against most cyber losses. Most insurance policies now specifically exclude coverage for such losses.
Corporations have responded by purchasing customized cyber liability coverage. Cyber insurance offsets the CGL cyber exclusion. Cyber policies specifically cover losses stemming from computer operations. Most combine traditional liability coverage protecting against third-party claims with first-party coverage that protects the insured.